Many applications using web services provide personally identifiable information (PII) to the web services. The web services use this information to ensure that the requester is authorized, to build user profiles to personalize the experience for the user, to detect and stop malicious attacks, such as denial of service, and to reduce the incidence of fraudulent access. Denial of service attacks are often implemented using automated agents, commonly known as bots, such as web robots that may concurrently access a particular web service from many different user devices. In addition to detecting unauthorized users, web services may detect other types of fraudulent access for example, when a user posts content on a web service and the web service agrees to pay the user based on the number of times the content is accessed. The user may employ bots to access the information, thus, inflating the number of accesses. In addition, users may modify the PII that is sent to the web services so that it appears that the requests originate at different client devices. Furthermore, when payment is required, there may be multiple requests from different web addresses that use the same credit card number. Providers of web services monitor the requests to detect these and other types of attacks and improper activity.